CN116193469A - Signaling transmission detection method, device, equipment and medium - Google Patents

Abstract

In the embodiment of the application, if the electronic device identifies that the network element sends the target signaling, the electronic device intercepts the target signaling, acquires a stored first code corresponding to the network element, and updates a code sequence to be detected corresponding to the target signaling stored in advance based on the first code, so that in the processing process of the target signaling, the electronic device can judge whether the transmission sequence of the current target signaling is wrong or not according to the existing code sequence to be detected and the target code sequence corresponding to the target signaling stored in advance when processing according to the standard flow corresponding to the target signaling, thereby improving the efficiency of signaling transmission detection.

Description

Signaling transmission detection method, device, equipment and medium

Technical Field

The present disclosure relates to the field of communications technologies, and in particular, to a method, an apparatus, a device, and a medium for detecting signaling transmission.

Background

The service architecture is an important feature of the fifth generation mobile communication system, and is a significant difference between the fifth generation core network (5Generation Core Network,5GC) and the traditional core network, wherein a standard flow of each service is stored in the 5GC, and after the 5GC receives a signaling carrying a service request sent by a User Equipment (UE), the processing can be performed according to the service carried in the signaling and the standard flow corresponding to the service.

However, when the 5GC processes the signaling according to the standard procedure, each sub-procedure in the standard procedure is completed by one network element, and different sub-procedures may be completed at the service layer corresponding to different network elements. That is, after the 5GC receives the signaling, the signaling needs to be transmitted between different network elements, which leads to a situation that there may be an error in signaling transmission sequence, that is, the signaling transmitted in the 5GC is not transmitted according to its corresponding standard flow.

In the prior art, since the network element cannot acquire the content carried in the signaling, only after the signaling transmission is finished, the 5GC determines whether an error occurs in the signaling transmission process according to the processing result of the signaling by the service layer corresponding to each network element carried in the signaling, which results in low efficiency of detecting whether an error occurs in the signaling transmission process.

Disclosure of Invention

The application provides a signaling transmission detection method, a device, equipment and a medium, which are used for solving the problem of low efficiency of detecting whether an error occurs in the signaling transmission process in the prior art.

The embodiment of the application provides a signaling transmission detection method, which comprises the following steps:

intercepting a target signaling sent by a network element, and acquiring a first code corresponding to the network element which is stored in advance;

Acquiring a stored code sequence to be detected corresponding to the target signaling according to the International Mobile Subscriber Identity (IMSI) carried in the target signaling, and updating the code sequence to be detected according to the first code;

and determining a target coding sequence corresponding to the target signaling according to the service identifier carried in the target signaling and the corresponding relation between the pre-stored service identifier and the coding sequence, and determining that the transmission of the target signaling is not in error if the target coding sequence contains the updated coding sequence to be detected.

Further, the method for determining the first code includes:

acquiring a preset character string template;

aiming at each preset field in the character string template, acquiring a stored target attribute represented by the preset field, and acquiring a stored attribute value of the network element under the target attribute; updating the content of the preset field in the character string template by adopting the attribute value;

and determining the character string template with each preset field updated as the first code.

Further, if the network element is the first network element to send the target signaling, after the obtaining the first code corresponding to the pre-stored network element, the method further includes:

Updating the message header of the target signaling by adopting the first code;

and according to the address carried in the target signaling, sending the updated target signaling to other network elements corresponding to the address.

Further, the updating the header of the target signaling with the first code includes:

and updating the content of a first preset position in the routing extension head SRH extension head of the message head by adopting the first code.

Further, if the network element is a non-first network element that sends the target signaling, after the obtaining the first code corresponding to the pre-stored network element, the method further includes:

acquiring a second code corresponding to a network element which is carried in a message header of the target signaling and transmits the target signaling last time;

updating the message header of the target signaling by adopting the first code and the second code;

and according to the address carried in the target signaling, sending the updated target signaling to other network elements corresponding to the address.

Further, updating the header of the target signaling with the first code and the second code includes:

updating the content of a first preset position in the SRH expansion header of the message header by adopting the first code;

And updating the content of a second preset position in the SRH expansion head of the message head by adopting the second code.

Further, the updating the coding sequence to be detected according to the first code includes:

the first code is added to the end of the code sequence to be detected.

The embodiment of the application also provides a signaling transmission detection device, which comprises:

the marking module is used for intercepting target signaling sent by a network element and acquiring a first code corresponding to the network element which is stored in advance; acquiring a stored code sequence to be detected corresponding to the target signaling according to the International Mobile Subscriber Identity (IMSI) carried in the target signaling, and updating the code sequence to be detected according to the first code;

and the analysis and detection module is used for determining a target coding sequence corresponding to the target signaling according to the service identifier carried in the target signaling and the corresponding relation between the pre-stored service identifier and the coding sequence, and determining that the transmission of the target signaling is not in error if the target coding sequence contains the updated coding sequence to be detected.

Further, the marking module is further configured to obtain a preset character string template; aiming at each preset field in the character string template, acquiring a stored target attribute represented by the preset field, and acquiring a stored attribute value of the network element under the target attribute; updating the content of the preset field in the character string template by adopting the attribute value; and determining the character string template with each preset field updated as the first code.

Further, the marking module is further configured to update a header of the target signaling with the first code if the network element is a first network element that sends the target signaling; and according to the address carried in the target signaling, sending the updated target signaling to other network elements corresponding to the address.

Further, the marking module is specifically configured to update the content of the first preset position in the routing extension header SRH extension header of the packet header by using the first code.

Further, the marking module is further configured to obtain a second code corresponding to a network element that sends the target signaling last time, where the second code is carried in a header of the target signaling, if the network element is a non-first network element that sends the target signaling; updating the message header of the target signaling by adopting the first code and the second code; and according to the address carried in the target signaling, sending the updated target signaling to other network elements corresponding to the address.

Further, the marking module is specifically configured to update the content of a first preset position in the SRH extension header of the header by using the first code; and updating the content of a second preset position in the SRH expansion head of the message head by adopting the second code.

Further, the analysis and detection module is specifically configured to add the first code to the end of the coding sequence to be detected.

The embodiment of the application also provides electronic equipment, which comprises a processor, wherein the processor is used for implementing the steps of any signaling transmission detection method when executing the computer program stored in the memory.

The present application further provides a computer readable storage medium storing a computer program, which when executed by a processor, implements the steps of any of the signaling transmission detection methods described above.

In the embodiment of the application, the electronic equipment intercepts a target signaling sent by a network element and acquires a first code corresponding to the pre-stored network element; acquiring a stored code sequence to be detected corresponding to the target signaling according to the International Mobile Subscriber Identity (IMSI) carried in the target signaling, and updating the code sequence to be detected according to the first code; and determining a target coding sequence corresponding to the target signaling according to the service identifier carried in the target signaling and the corresponding relation between the pre-stored service identifier and the coding sequence, and determining that the transmission of the target signaling is not in error if the target coding sequence contains the updated coding sequence to be detected. In the embodiment of the application, if the electronic device identifies that the network element sends the target signaling, the electronic device intercepts the target signaling, acquires the stored first code corresponding to the network element, and updates the pre-stored code sequence to be detected corresponding to the target signaling based on the first code, so that in the processing process of the target signaling, the electronic device can judge whether the transmission sequence of the current target signaling is wrong or not according to the existing code sequence to be detected and the pre-stored target code sequence corresponding to the target signaling when processing according to the standard flow corresponding to the target signaling, thereby improving the efficiency of signaling transmission detection.

Drawings

In order to more clearly illustrate the technical solutions of the present application, the drawings that are needed in the description of the embodiments will be briefly described below, it being obvious that the drawings in the following description are only some embodiments of the present application, and that other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

Fig. 1 is a schematic diagram of a signaling transmission detection process provided in an embodiment of the present application;

fig. 2 is a schematic structural diagram of a monitoring system according to an embodiment of the present application;

fig. 3 is a schematic structural diagram of an IMSI according to an embodiment of the present disclosure;

fig. 4 is a schematic diagram of a preset field corresponding to a character string template provided in an embodiment of the present application;

fig. 5 is a schematic diagram of each preset field value provided in the embodiment of the present application;

fig. 6 is a schematic diagram of a preamble flow message type provided in an embodiment of the present application;

fig. 7 is a schematic diagram of a triggering manner provided in an embodiment of the present application;

fig. 8 is a schematic diagram of a header of a target signaling provided in an embodiment of the present application;

fig. 9 is a schematic diagram of fields corresponding to the Optional TLV provided in the embodiment of the present application;

fig. 10 is a schematic diagram of a newly defined Optional TLV provided in an embodiment of the present application;

Fig. 11 is a schematic diagram of a signaling transmission process according to an embodiment of the present application;

fig. 12 is a schematic structural diagram of a signaling transmission detection apparatus according to an embodiment of the present application;

fig. 13 is a schematic structural diagram of an electronic device according to an embodiment of the present application.

Detailed Description

For the purposes of making the objects, technical solutions and advantages of the present application more apparent, the present application will be described in further detail below with reference to the accompanying drawings, wherein it is apparent that the described embodiments are only some, but not all, of the embodiments of the present application. All other embodiments, which can be made by one of ordinary skill in the art without undue burden from the present disclosure, are within the scope of the present disclosure.

In order to improve efficiency and accuracy of signaling transmission detection, the embodiment of the application provides a signaling transmission detection method, a device, equipment and a medium.

In the embodiment of the application, the electronic equipment intercepts a target signaling sent by a network element and acquires a first code corresponding to the pre-stored network element; acquiring a stored code sequence to be detected corresponding to the target signaling according to the International Mobile Subscriber Identity (IMSI) carried in the target signaling, and updating the code sequence to be detected according to the first code; and determining a target coding sequence corresponding to the target signaling according to the service identifier carried in the target signaling and the corresponding relation between the pre-stored service identifier and the coding sequence, and determining that the transmission of the target signaling is not in error if the target coding sequence contains the updated coding sequence to be detected.

Example 1:

fig. 1 is a schematic diagram of a signaling transmission detection process provided in an embodiment of the present application, where the process includes:

s101: intercepting a target signaling sent by a network element, and acquiring a first code corresponding to the network element which is stored in advance.

The signaling transmission detection method provided by the embodiment of the application is applied to electronic equipment, wherein the electronic equipment can be a PC or a server, and a monitoring system is deployed in the electronic equipment.

Fig. 2 is a schematic structural diagram of a monitoring system provided in an embodiment of the present application, and as shown in fig. 2, the detection system includes, but is not limited to, a User Equipment (UE), a 5G radio access network (NG Radio Access Network, NG-RAN), a 5GC, a marking module, a protocol stack, a relay, an acquisition module, an analysis detection module, and an execution module. The system comprises a UE, an analysis detection module, an execution module and a network management module, wherein the UE is used for interacting NAS signaling with the 5GC, the NG-RAN is used for establishing NAS signaling bearing for the UE and the 5GC, the 5GC network element is a 5GC signaling producer and consumer, the collection module is used for collecting signaling traffic from a network, the analysis detection module is used for analyzing signaling behavior according to marking information in the collected traffic, and the execution module is used for tracing and positioning abnormal signaling and executing a preset strategy.

In a practical application scenario, the 5G core network signaling (5 GC signaling) has been completely implemented with internet protocol addresses (internet protocol address, IP), and IPv 6-based segment routing (segment routing IPv, SRv 6) is one of implementation means of 5G network slicing. For the 5GC network deployed SRv, besides the scheme described in the embodiment of the present application, the segment routing extension header (segment routing header, SRH) optionally perfects +encapsulation +parsing (Type, length, value, TLV) definition, maps the wireless access procedure, authentication procedure, and core network signaling procedure, and can mark the 5GC signaling flow, thereby being capable of identifying the meaning and relationship of the signaling message and implementing judgment of signaling abnormality. For example, when a 5GC service fails, is contaminated, or a signaling loss, a signaling tampering, a ghost signaling, a flooding attack, an illegal request, or a data leak occurs, a signaling analysis may be performed in a message relay based on a SRv flag, and an anomaly may be found.

Based on this, in the embodiment of the present application, the user sends the target signaling to the 5GC through the UE, where the target signaling carries the service required by the UE, and the 5GC responds to the target signaling after receiving the target signaling. In an actual application scenario the UE initiates network attached storage (network attached storage, NAS) signaling to the 5GC, which in this example is the sending network element to the 5GC. It may also be a 5GC that initiates NAS message to the UE to trigger the UE to initiate NAS signaling to the 5GC.

However, the 5GC may include multiple sub-flows in response to the target signaling, and different sub-flows may be completed at the service layers corresponding to different network elements. That is, after the 5GC receives the target signaling, the target signaling needs to be transmitted between different network elements, which results in a situation that there may be an error in the transmission sequence of the target signaling, that is, the signaling transmitted in the 5GC is not transmitted according to the standard flow corresponding to the signaling.

Based on this, in the embodiment of the present application, in a process that a network element for executing one sub-flow sends a target signaling to a next network element for executing the next sub-flow in 5GC, an electronic device intercepts the target signaling sent by the network element, and sends the network element of the target signaling by using a preset identification mark, so that whether an error occurs in the transmission process of the target signaling can be determined according to the mark corresponding to the target signaling sent by each network element.

Specifically, a network operation Service (NF Service, NF) of the network element normally sends out a target signaling, encapsulates the target signaling through a hypertext transfer protocol (HyperText Transfer Protocol, HTTP), and is intercepted by the electronic device in a kernel space of 5 GC. And the electronic equipment acquires the stored first code corresponding to the network element. The first code may be a sequence number of the network element in a standard flow corresponding to the service when the network element executes the service corresponding to the target signaling, or may be other contents, which is not limited herein.

S102: and acquiring a stored code sequence to be detected corresponding to the target signaling according to the International Mobile Subscriber Identity (IMSI) carried in the target signaling, and updating the code sequence to be detected according to the first code.

In the embodiment of the present application, for the signaling sent by each UE, the response sequence of each network element when the 5GC responds to the signaling sent by the UE is stored in the electronic device. In this embodiment of the present application, the electronic device stores the corresponding sequence of each network element in the coding sequence to be detected.

Specifically, in the embodiment of the present application, when the UE sends the target signaling to the 5GC, the UE may also send an international mobile subscriber identity (International Mobile Subscriber Identity, IMSI) to the 5GC, where the UE may send the target signaling and the IMSI to the 5GC at the same time, or may also add the IMSI to the target signaling, and then send the target signaling carrying the IMSI to the 5 GC.

In the embodiment of the application, when the electronic device stores the code of the sequence to be detected corresponding to each UE, the corresponding relationship between the stored IMSI of each UE and the code sequence to be detected is stored. Based on this, in the embodiment of the present application, the electronic device needs to determine the IMSI corresponding to the target signaling, and determine the coding sequence to be detected corresponding to the target signaling through the IMSI.

Specifically, in this embodiment of the present application, the electronic device may send, to a network element that sends the target signaling, a request for obtaining an IMSI corresponding to the target signaling, and determine, according to an IMSI carried in response information returned by the network element and a correspondence between a pre-stored coding sequence to be detected and an IMSI, that the IMSI corresponds to the coding sequence to be detected. The electronic device may update the code sequence to be detected according to the first code corresponding to the network element.

Fig. 3 is a schematic structural diagram of an IMSI according to an embodiment of the present application, as shown in fig. 3, the IMSI has 15 or 16 strings (Digits), wherein the IMSI is composed of a mobile country code (Mobile Country Code, MCC), a mobile network code (Mobile Network Code, MNC) and an identification number (Mobile Subscriber Identification Number, MSIN) of a mobile subscriber, and the specific MCC, MNC and MSIN are sequentially arranged to form the IMSI, wherein the MCC has 3Digits, the MNC has 2 or 3Digits, and the MSIN has 9 or 10Digits.

In this embodiment, the IMSI may be represented by 56 bits (bits), the MCC may be represented by 6 bits, the MNC may be represented by 6 bits, and the MSIN may be represented by 20 bits. S103: and determining a target coding sequence corresponding to the target signaling according to the service identifier carried in the target signaling and the corresponding relation between the pre-stored service identifier and the coding sequence, and determining that the transmission of the target signaling is not in error if the target coding sequence contains the updated coding sequence to be detected.

S103: and determining a target coding sequence corresponding to the target signaling according to the service identifier carried in the target signaling and the corresponding relation between the pre-stored service identifier and the coding sequence, and determining that the transmission of the target signaling is not in error if the target coding sequence contains the updated coding sequence to be detected.

In this embodiment of the present application, a standard flow of each service provided by the 5GC is stored in the electronic device, that is, a coding sequence corresponding to each service identifier is stored in the electronic device, where the coding sequence is a sequence of a first code of each network element that is sequentially processed when the 5GC processes signaling corresponding to each service identifier according to the standard flow.

The services include, but are not limited to, a main service and a sub-service, wherein the main service includes, but is not limited to, an initial registration process service, a periodic registration process service, a deregistration process service, an authentication process service, a session establishment process service, a session change process service, a session release process service, a slice selection process service, a policy download process service and the like, and the sub-service is other process services nested in the main service.

Based on this, in the embodiment of the present application, for the target signaling sent by the intercepted network element, the electronic device may determine, according to the service identifier carried in the target signaling and the correspondence between the pre-stored service identifier and the coding sequence, the target coding sequence corresponding to the target sequence. If the electronic equipment determines that the target coding sequence contains the updated coding sequence to be detected, the electronic equipment determines that the transmission of the target signaling is not in error.

In the embodiment of the application, if the electronic device identifies that the network element sends the target signaling, the electronic device intercepts the target signaling, acquires the stored first code corresponding to the network element, and updates the pre-stored code sequence to be detected corresponding to the target signaling based on the first code, so that in the processing process of the target signaling, the electronic device can judge whether the transmission sequence of the current target signaling is wrong or not according to the existing code sequence to be detected and the pre-stored target code sequence corresponding to the target signaling when processing according to the standard flow corresponding to the target signaling, thereby improving the efficiency of signaling transmission detection.

Example 2:

in order to better identify the network element, on the basis of the foregoing embodiment, in an embodiment of the present application, the method for determining the first code includes:

acquiring a preset character string template;

aiming at each preset field in the character string template, acquiring a stored target attribute represented by the preset field, and acquiring a stored attribute value of the network element under the target attribute; updating the content of the preset field in the character string template by adopting the attribute value;

and determining the character string template with each preset field updated as the first code.

In this embodiment of the present application, a preset character string template is stored in the electronic device, and the electronic device may determine, based on the preset character string template, a first code corresponding to each network element.

Specifically, in the embodiment of the present application, the string template includes at least one preset field, and each preset field represents a different attribute, for example, preset field 1 represents a trigger mode, and preset field 2 represents a first message flag. For each preset field, the electronic equipment acquires the target attribute represented by the preset field, acquires the attribute value of the network element under the target attribute, and updates the content of the preset field in the character string template by adopting the attribute value. And the electronic equipment determines a first code corresponding to the network element by updating the character string template of which each preset field is completed.

Wherein, in the embodiment of the present application, each preset field of the string template includes, but is not limited to: the method comprises the steps of pre-flow message type, trigger mode, first message sign, optional flow, main flow, sub-flow and message number. Wherein the pre-flow message types include, but are not limited to, 5GC messages, NAS messages, AF messages, B-domain, and O-domain; the triggering mode includes but is not limited to UE triggering, RAN triggering, 5GC triggering and management triggering; the first message mark is a first message or a non-first message; the optional flow is an optional flow or a non-optional flow, that is, the optional flow is that in the service corresponding to the target signaling, the target signaling may be sent to the network element, or the target signaling may not be sent to the network element.

Fig. 4 is a schematic diagram of preset fields corresponding to a character string template provided in the embodiment of the present application, where, as shown in fig. 4, the character string template includes 7 preset fields, which are respectively a type of a pre-flow message, a triggering mode, a first message flag, an optional flow, a main flow, a sub-flow, and a message number.

Based on fig. 4, fig. 5 is a schematic diagram of a value of each preset field provided in the embodiment of the present application, as shown in fig. 5, a message type of a pre-process corresponds to bits 0-3 of a string template, a triggering mode corresponds to bits 4-5 of the string template, a first message instruction corresponds to bits 6 of the string template, an optional process corresponds to bits 7 of the string template, a main process corresponds to bits 8-16 of the string template, a sub-process corresponds to bits 17-24 of the string template, and a message number corresponds to bits 25-32 of the string template. Wherein the first message trigger flag is 0 or 1, the optional flow is 0 or 1, and the main flow, the sub-flow and the message number are numbered according to 3GPP specifications.

Fig. 6 is a schematic diagram of the types of the messages in the preamble flow provided in the embodiment of the present application on the basis of fig. 4 and fig. 5, and as shown in fig. 6, the preamble message processing flow includes a 5GC message, a NAS message, an AF message, a B domain, and an O domain. If the pre-message processing procedure is a 5GC message, the attribute value corresponding to the pre-message processing procedure is 0001, if the pre-message processing procedure is a NAS message, the attribute value corresponding to the pre-message processing procedure is 0010, if the pre-message processing procedure is an AF message, the attribute value corresponding to the pre-message processing procedure is 1000, if the pre-message processing procedure is a B field, the attribute value corresponding to the pre-message processing procedure is 1001, and if the pre-message processing procedure is an O field, the attribute value corresponding to the pre-message processing procedure is 1011.

Fig. 7 is a schematic diagram of a trigger mode provided in this embodiment of the present application, where, as shown in fig. 7, the trigger mode includes UE trigger, RAN trigger, 5GC trigger and management trigger, if the trigger mode is UE trigger, an attribute value corresponding to the trigger mode is 00, if the trigger mode is RAN trigger, an attribute value corresponding to the trigger mode is 01, if the trigger mode is 5GC trigger, an attribute value corresponding to the trigger mode is 10, and if the trigger mode is management trigger, an attribute value corresponding to the trigger mode is 11.

Example 3:

in order to better detect the signaling transmission process, in the embodiments of the present application, after the obtaining the first code corresponding to the pre-stored network element, if the network element is the first network element that sends the target signaling, the method further includes:

updating the message header of the target signaling by adopting the first code;

and according to the address carried in the target signaling, sending the updated target signaling to other network elements corresponding to the address.

In order to better detect signaling transmission, so that the electronic device can better update the coding sequence to be detected corresponding to the target signaling, in the embodiment of the present application, the electronic device encapsulates the first code corresponding to the network element into the header of the target signaling.

Specifically, in the embodiment of the present application, if the network element is the first network element to send the target signaling, the electronic device updates the header of the target signaling with the first code corresponding to the network element, and sends the updated target signaling to other network elements corresponding to the address according to the address carried in the target signaling.

In this embodiment of the present application, the target signaling is generally SRv message.

In addition, in the embodiment of the present application, when the electronic device updates the header of the target signaling with the first code, the IMSI corresponding to the target signaling may also be added to the header.

In order to better detect the signaling transmission process, based on the foregoing embodiments, in the embodiments of the present application, updating the header of the target signaling with the first code includes:

and updating the content of a first preset position in the routing extension head SRH extension head of the message head by adopting the first code.

Based on the foregoing, in the embodiment of the present application, when updating a header corresponding to a target signaling by using a first code, the electronic device updates the header to: the electronic device updates a first preset position of a routing extension header (Segment Routing Header, SRH) of the header with the first code.

Example 4:

in order to better detect the signaling transmission process, in the embodiments of the present application, if the network element is a non-first network element sending the target signaling, after the obtaining the first code corresponding to the pre-stored network element, the method further includes:

Acquiring a second code corresponding to a network element which is carried in a message header of the target signaling and transmits the target signaling last time;

updating the message header of the target signaling by adopting the first code and the second code;

and according to the address carried in the target signaling, sending the updated target signaling to other network elements corresponding to the address.

In order to better detect signaling transmission, so that the electronic device can better update the coding sequence to be detected corresponding to the target signaling, in the embodiment of the present application, the electronic device encapsulates the first code corresponding to the network element and the second code corresponding to the network element that last sent the target signaling, which is carried in the message header of the target signaling, into the message header of the target signaling.

Specifically, in this embodiment of the present application, if the network element is a non-first network element that sends the target signaling, the electronic device obtains a second code corresponding to a network element that sends the target signaling last time, which is carried in a header of the target signaling, updates the header of the target signaling by using the first code and the second code corresponding to the network element, and sends the updated target signaling to other network elements corresponding to the address according to the address carried in the target signaling.

In this embodiment of the present application, the target signaling is generally SRv message. In addition, in the embodiment of the present application, when the electronic device updates the header of the target signaling by using the first code and the second code, the IMSI corresponding to the target signaling may also be added to the header.

In order to better detect the signaling transmission process, based on the foregoing embodiments, in the embodiments of the present application, updating the header of the target signaling with the first code and the second code includes:

updating the content of a first preset position in the SRH expansion header of the message header by adopting the first code;

and updating the content of a second preset position in the SRH expansion head of the message head by adopting the second code.

And updating the content of a first preset position in the routing extension head SRH extension head of the message head by adopting the first code.

Based on the foregoing, in the embodiment of the present application, when the electronic device updates the header corresponding to the target signaling by using the first code and the second code, the method includes: the electronic device updates a first preset position of the SRH of the message header by adopting the first code, and updates the content of a second preset position in the SRH expansion header of the message header by adopting the second code.

Fig. 8 is a schematic diagram of a header of a target signaling provided in an embodiment of the present application, where, as shown in fig. 8, the target signaling is a SRv6 packet, and the header of the target signaling includes an IPv6 header, an SRH, and an IPv6 payload. The IPv6 header is the basic message, and includes 40 bytes in total, and if the electronic device recognizes that the type of the next header in the IPv6 header is SRH, that is, the electronic device recognizes that the value at the field corresponding to the type of the next header in the IPv6 header is 43, the electronic device accesses the field corresponding to the SRH of the header of the target signaling. The SRH field is the same as the prior art, including but not limited to an Optional type-length-value (Optional Type Length Value, optional TLV).

Fig. 9 is a schematic diagram of fields corresponding to an Optional TLV provided in the embodiment of the present application on the basis of fig. 8, where, as shown in fig. 9, the Optional TLV includes a plurality of subfields, and each subfield corresponds to a different meaning, where a first subfield corresponding to bits 7-123 and a second subfield corresponding to bits 128-251 are unassigned subfields, and the electronic device may add the first code, the second code, and the IMSI to the two subfields.

Based on this, in the embodiment of the present application, the technician may select a preset number of bits from the two subfields to customize, and identify the meaning corresponding to the preset number of bits as the signaling context protocol type, which is used for writing the first code, the second code and the IMSI or writing the first code and the IMSI.

For example, the technician may customize the subfield with the length (16+32+32+64)/8 starting from the 7 th bit of the Optional TLV of the SRH to be the subfield corresponding to the signaling context protocol type. I.e. type=7, length= (16+32+32+64)/8, value=first code+second code+imsi of this subfield.

Fig. 10 is a schematic diagram of a newly defined Optional TLV provided in an embodiment of the present application, and as shown in fig. 10, the Optional TLV includes a Type (Type), a Length (Length), a storage (Reserved), a first encoding (MSG-Seq-Info), a second encoding (PreMSG-Seq-Info), and an IMSI.

Example 5:

in order to improve the efficiency of signaling transmission detection, in the embodiments of the present application, updating the coding sequence to be detected according to the first code includes:

the first code is added to the end of the code sequence to be detected.

In this embodiment of the present application, after intercepting a target signaling sent by a gateway, the electronic device adds a first number corresponding to the gateway to a coding sequence to be detected. Because, in the embodiment of the present application, the electronic device needs to determine whether an error occurs in the signaling transmission process according to the to-be-detected coding sequence corresponding to the actual signaling transmission sequence of the gateway and the target coding sequence corresponding to the standard flow, and then the electronic device needs to determine the end of the to-be-detected coding sequence according to the actual transmission sequence.

Fig. 11 is a schematic diagram of a signaling transmission process according to an embodiment of the present application.

1. The UE generates NAS signaling.

2. The UE initiates NAS signaling to the network element 1 of the 5GC, or the network element 1 of the 5GC initiates a departure message for acquiring the NAS message to the UE.

In this way, the transmitting network element may obtain the IMSI of the UE.

3. The network element 1 sends out target signaling (5 GC signaling), and the message is encapsulated by HTTP and intercepted by the tagging module in the kernel space. Wherein the purpose of interception is not to send directly to the network element 2.

And 4-5, the marking module calls a network service interface, and obtains the corresponding IMSI according to the message body, the process ID and the like.

6. The marking module obtains a first code corresponding to the stored network element 1, and fills the first code, a second code of the last network element and the IMSI into a preset position of the SRH Optional TLV of IPv 6.

7-8, target signaling transfer.

9. The protocol stack of the network element 2 processes the message and gives it to the parsing module and the proxy interface of the network service according to the optional field meaning.

10-11, the parsing module of the network element 2 calls the IP layer interface to acquire the necessary fields.

12. The analysis module of the network element 2 reserves the IMSI, the first code and the necessary information of the access process and transmits the information to the marking module.

13. The parsing module of the network element 2 gives the regular signaling messages (5 GC signaling) to the application layer.

14. The network service of the network element 2 carries out signaling logic processing, sends out the next signaling, is encapsulated by HTTP, and is intercepted by the marking module in the kernel space.

15-17, the marking module of the network element 2 repeatedly executes 4-6.

18. The protocol stack of the network element 2 repeatedly performs 7.

19. The acquisition module of the electronic equipment acquires in a host kernel protocol stack or a network relay, extracts a source IP, a destination IP and an SRH Optional TLV, obtains a first code, an IMSI and a second code, and performs data arrangement.

20. And a detection analysis module of the monitoring system draws a message sequence by taking the IMSI as granularity based on the sorted data, and compares the message sequence with a standard flow definition to analyze deviation reasons.

And the checking and analyzing module draws a message sequence by taking the IMSI as granularity based on the sorted data, and compares the message sequence with the standard flow definition to analyze the deviation reason.

The method can be realized by the following steps:

and establishing a standard flow message number index and a message mapping.

The standard flow mainly comprises a main flow and a sub-flow, wherein the main flow comprises an initial registration flow, a periodic registration flow, a deregistration flow, an authentication flow, a session establishment flow, a session change flow, a session release flow, a slice selection flow, a strategy downloading flow and the like. The sub-flows include other main flows nested in each main flow, or alternative flows for different cases. Message sequence number: the sequence of each main flow and each sub flow is orderly arranged. And reading the association relation before and after the signaling through the http header of the acquired signaling message, and comparing the standard flow through the message number index.

And judging the abnormality, wherein the abnormality mainly comprises signaling abnormality, user abnormality and flow abnormality. Wherein the signaling anomalies include error signaling, ghost signaling, missing signaling, and signaling flooding; the user exception includes registration exception, session exception, policy exception, handover exception, access exception; the flow exception includes flow blocking, signaling loop, tandem error, illegal request.

21. And further analyzing behavior characteristics of the anomalies of the specific terminal and the specific network service, and if the behavior characteristics are matched with the network security characteristic library, executing treatment, plugging the terminal, migrating the network service and the like through a 5G network manager.

Compared with the related art that the content of the HTTP analysis message is mainly de-encapsulated, the embodiment of the present application is based on the network layer SRv SRH, and the necessary information required for signaling monitoring can be obtained without de-encapsulating the HTTP message, which is a prompt for the acquisition efficiency. In addition, the network elements (network equipment) can be used as acquisition points, and the acquisition mode is more flexible. And, the signaling flow of the 3GPP standard is described based on the message coding, an anomaly analysis method of the signaling flow compared with the standard flow is designed, and compared with the existing problem tracing and obstacle removing scheme based on logs, the embodiment of the application can rapidly locate the anomaly of the signaling flow and can discriminate access fraud of a certain means.

Example 6:

fig. 12 is a schematic structural diagram of a signaling transmission detection apparatus according to an embodiment of the present application, where the apparatus includes:

a marking module 1201, configured to intercept a target signaling sent by a network element, and obtain a first code corresponding to the network element that is stored in advance; acquiring a stored code sequence to be detected corresponding to the target signaling according to the International Mobile Subscriber Identity (IMSI) carried in the target signaling, and updating the code sequence to be detected according to the first code;

The analysis detection module 1202 is configured to determine, according to a service identifier carried in the target signaling and a correspondence between a pre-stored service identifier and a code sequence, a target code sequence corresponding to the target signaling, and if the target code sequence includes an updated code sequence to be detected, determine that transmission of the target signaling is not in error.

Further, the marking module 1201 is further configured to obtain a preset character string template; aiming at each preset field in the character string template, acquiring a stored target attribute represented by the preset field, and acquiring a stored attribute value of the network element under the target attribute; updating the content of the preset field in the character string template by adopting the attribute value; and determining the character string template with each preset field updated as the first code.

Further, the marking module 1201 is further configured to update a header of the target signaling with the first code if the network element is a first network element that sends the target signaling; and according to the address carried in the target signaling, sending the updated target signaling to other network elements corresponding to the address.

Further, the marking module 1201 is specifically configured to update the content of the first preset position in the routing extension header SRH extension header of the header by using the first code.

Further, the marking module 1201 is further configured to obtain a second code corresponding to a network element that sends the target signaling last time, where the second code is carried in a header of the target signaling if the network element is a non-first network element that sends the target signaling; updating the message header of the target signaling by adopting the first code and the second code; and according to the address carried in the target signaling, sending the updated target signaling to other network elements corresponding to the address.

Further, the marking module 1201 is specifically configured to update the content of the first preset position in the SRH extension header of the header by using the first code; and updating the content of a second preset position in the SRH expansion head of the message head by adopting the second code.

Further, the analysis and detection module 1202 is specifically configured to add the first code to the end of the coding sequence to be detected.

Example 7:

on the basis of the foregoing embodiments, the embodiment of the present application further provides an electronic device, and fig. 13 is a schematic structural diagram of the electronic device provided in the embodiment of the present application, as shown in fig. 13, including: processor 1301, communication interface 1302, memory 1303 and communication bus 1304, wherein processor 1301, communication interface 1302, memory 1303 complete the communication between each other through communication bus 1304;

The memory 1303 stores a computer program that, when executed by the processor 1301, causes the processor 1301 to perform the steps of:

intercepting a target signaling sent by a network element, and acquiring a first code corresponding to the network element which is stored in advance;

acquiring a stored code sequence to be detected corresponding to the target signaling according to the International Mobile Subscriber Identity (IMSI) carried in the target signaling, and updating the code sequence to be detected according to the first code;

and determining a target coding sequence corresponding to the target signaling according to the service identifier carried in the target signaling and the corresponding relation between the pre-stored service identifier and the coding sequence, and determining that the transmission of the target signaling is not in error if the target coding sequence contains the updated coding sequence to be detected.

In one possible implementation, the processor is further configured to:

acquiring a preset character string template;

aiming at each preset field in the character string template, acquiring a stored target attribute represented by the preset field, and acquiring a stored attribute value of the network element under the target attribute; updating the content of the preset field in the character string template by adopting the attribute value;

And determining the character string template with each preset field updated as the first code.

In one possible implementation, the processor is further configured to:

updating the message header of the target signaling by adopting the first code;

and according to the address carried in the target signaling, sending the updated target signaling to other network elements corresponding to the address.

In one possible implementation, the processor is further configured to:

and updating the content of a first preset position in the routing extension head SRH extension head of the message head by adopting the first code.

In one possible implementation, the processor is further configured to:

acquiring a second code corresponding to a network element which is carried in a message header of the target signaling and transmits the target signaling last time;

updating the message header of the target signaling by adopting the first code and the second code;

and according to the address carried in the target signaling, sending the updated target signaling to other network elements corresponding to the address.

In one possible implementation, the processor is further configured to:

updating the content of a first preset position in the SRH expansion header of the message header by adopting the first code;

And updating the content of a second preset position in the SRH expansion head of the message head by adopting the second code.

In one possible implementation, the processor is further configured to:

the first code is added to the end of the code sequence to be detected.

Since the principle of the electronic device for solving the problem is similar to that of the signaling transmission detection method, the implementation of the electronic device can refer to the embodiment of the method, and the repetition is omitted.

The communication bus mentioned above for the electronic devices may be a peripheral component interconnect standard (Peripheral Component Interconnect, PCI) bus or an extended industry standard architecture (Extended Industry Standard Architecture, EISA) bus, etc. The communication bus may be classified as an address bus, a data bus, a control bus, or the like. For ease of illustration, the figures are shown with only one bold line, but not with only one bus or one type of bus. The communication interface 1302 is used for communication between the electronic device and other devices. The Memory may include random access Memory (Random Access Memory, RAM) or may include Non-Volatile Memory (NVM), such as at least one disk Memory. Optionally, the memory may also be at least one memory device located remotely from the aforementioned processor.

The processor may be a general-purpose processor, including a central processing unit, a network processor (Network Processor, NP), etc.; but also digital instruction processors (Digital Signal Processing, DSP), application specific integrated circuits, field programmable gate arrays or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

Example 8:

on the basis of the above embodiments, the embodiments of the present invention further provide a computer readable storage medium, in which a computer program executable by a processor is stored, which when executed on the processor causes the processor to implement the steps of:

intercepting a target signaling sent by a network element, and acquiring a first code corresponding to the network element which is stored in advance;

acquiring a stored code sequence to be detected corresponding to the target signaling according to the International Mobile Subscriber Identity (IMSI) carried in the target signaling, and updating the code sequence to be detected according to the first code;

and determining a target coding sequence corresponding to the target signaling according to the service identifier carried in the target signaling and the corresponding relation between the pre-stored service identifier and the coding sequence, and determining that the transmission of the target signaling is not in error if the target coding sequence contains the updated coding sequence to be detected.

In one possible implementation manner, the method for determining the first code includes:

acquiring a preset character string template;

aiming at each preset field in the character string template, acquiring a stored target attribute represented by the preset field, and acquiring a stored attribute value of the network element under the target attribute; updating the content of the preset field in the character string template by adopting the attribute value;

and determining the character string template with each preset field updated as the first code.

In a possible implementation manner, if the network element is the first network element to send the target signaling, after the obtaining the first code corresponding to the pre-stored network element, the method further includes:

updating the message header of the target signaling by adopting the first code;

and according to the address carried in the target signaling, sending the updated target signaling to other network elements corresponding to the address.

In a possible implementation manner, the updating the header of the target signaling with the first code includes:

and updating the content of a first preset position in the routing extension head SRH extension head of the message head by adopting the first code.

In a possible implementation manner, if the network element is a non-first network element that sends the target signaling, after the obtaining the first code corresponding to the pre-stored network element, the method further includes:

acquiring a second code corresponding to a network element which is carried in a message header of the target signaling and transmits the target signaling last time;

updating the message header of the target signaling by adopting the first code and the second code;

and according to the address carried in the target signaling, sending the updated target signaling to other network elements corresponding to the address.

In a possible implementation manner, the updating the header of the target signaling with the first code and the second code includes:

updating the content of a first preset position in the SRH expansion header of the message header by adopting the first code;

and updating the content of a second preset position in the SRH expansion head of the message head by adopting the second code.

In a possible implementation manner, the updating the coding sequence to be detected according to the first code includes:

the first code is added to the end of the code sequence to be detected.

It will be appreciated by those skilled in the art that embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to the application. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present application without departing from the spirit or scope of the application. Thus, if such modifications and variations of the present application fall within the scope of the claims and the equivalents thereof, the present application is intended to cover such modifications and variations.

Claims (10)

1. A signaling transport detection method, the method comprising:

intercepting a target signaling sent by a network element, and acquiring a first code corresponding to the network element which is stored in advance;

acquiring a stored code sequence to be detected corresponding to the target signaling according to the International Mobile Subscriber Identity (IMSI) carried in the target signaling, and updating the code sequence to be detected according to the first code;

and determining a target coding sequence corresponding to the target signaling according to the service identifier carried in the target signaling and the corresponding relation between the pre-stored service identifier and the coding sequence, and determining that the transmission of the target signaling is not in error if the target coding sequence contains the updated coding sequence to be detected.

2. The method of claim 1, wherein the first encoding determination method comprises:

acquiring a preset character string template;

aiming at each preset field in the character string template, acquiring a stored target attribute represented by the preset field, and acquiring a stored attribute value of the network element under the target attribute; updating the content of the preset field in the character string template by adopting the attribute value;

And determining the character string template with each preset field updated as the first code.

3. The method according to claim 1, wherein, if the network element is the first network element to send the target signaling, after the obtaining the first code corresponding to the pre-stored network element, the method further includes:

updating the message header of the target signaling by adopting the first code;

and according to the address carried in the target signaling, sending the updated target signaling to other network elements corresponding to the address.

4. The method of claim 3, wherein updating the header of the target signaling with the first code comprises:

and updating the content of a first preset position in the routing extension head SRH extension head of the message head by adopting the first code.

5. The method according to claim 1, wherein, if the network element is a non-first network element that sends the target signaling, after the obtaining the first code corresponding to the pre-stored network element, the method further comprises:

acquiring a second code corresponding to a network element which is carried in a message header of the target signaling and transmits the target signaling last time;

Updating the message header of the target signaling by adopting the first code and the second code;

and according to the address carried in the target signaling, sending the updated target signaling to other network elements corresponding to the address.

6. The method of claim 5, wherein updating the header of the target signaling with the first code and the second code comprises:

updating the content of a first preset position in the SRH expansion header of the message header by adopting the first code;

and updating the content of a second preset position in the SRH expansion head of the message head by adopting the second code.

7. The method of claim 1, wherein the updating the sequence of codes to be detected according to the first code comprises:

the first code is added to the end of the code sequence to be detected.

8. A signaling transport detection apparatus, the apparatus comprising:

the marking module is used for intercepting target signaling sent by a network element and acquiring a first code corresponding to the network element which is stored in advance; acquiring a stored code sequence to be detected corresponding to the target signaling according to the International Mobile Subscriber Identity (IMSI) carried in the target signaling, and updating the code sequence to be detected according to the first code;

And the analysis and detection module is used for determining a target coding sequence corresponding to the target signaling according to the service identifier carried in the target signaling and the corresponding relation between the pre-stored service identifier and the coding sequence, and determining that the transmission of the target signaling is not in error if the target coding sequence contains the updated coding sequence to be detected.

9. An electronic device, characterized in that it comprises a processor for implementing the steps of the signaling transmission detection method according to any of claims 1-7 when executing a computer program stored in a memory.

10. A computer readable storage medium, characterized in that it stores a computer program which, when executed by a processor, implements the steps of the signaling transmission detection method according to any of claims 1-7.

Images